CVE-2026-107370

CVSS 5.3 (medium) · published 2026-10-13

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.

Weakness: CWE-532, CWE-598

Source: NVD CVE-2026-107370

References

• https://github.com/auth0/lock/security/advisories/GHSA-mp8m-wcxp-w648
• https://trust.okta.com/security-advisories/improper-request-handling-for-active-directory-logins-in-auth0-lock-cve-2026-107370

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.